What we can see, and what we can't.
Pastel Cloud is built so that the contents of your work never reach us in a form we can read, unless you choose to publish them. This page explains what that means in practice, including the parts that are still visible to us and the trade-offs that come with it.
We can't see
- What is inside the files, sheets, photos and notes you keep private.
- What you write and edit in work you share only with the people you invite.
- Your recovery passphrase, your passkeys or the private keys on your devices.
- We never see your full card number. Our payment provider, Polar, processes your payment.
We can see
- That your account exists, and its public keys.
- How much storage you use, so we can bill for it and warn you before you run out.
- When your devices sync, and which shared group a sealed item belongs to.
- What kind of sealed item each one is (a file, a sheet, a photo), and when it was created or last changed.
- Which accounts share a group, so we can route updates to the right devices.
- Your email address, if you give it to us for the waitlist.
- For billing: your email address, name, billing address and country, plus the card type and its last four digits, which Polar shares with us.
- Anything you publish. A published post is public: anyone with the link can read it, including our staff.
We need this much to run the service, sync your devices and charge for storage. We don't sell it, and we don't use it for ads.
How something stays sealed on the way.
Sealed on your device
When you create or change something, your device encrypts it with keys that only your devices and the people you invite hold.
Synced as sealed boxes
Only the encrypted version travels through our servers. It reaches your other devices, where your keys open it again.
Shared by handing over a key
When you invite someone, your device gives them the key, sealed so that only they can use it. We pass it along without being able to open it.
Removing someone changes the lock
Take a person off a shared folder or album and it gets a new key. They keep nothing new from that point on.
What this asks of you, and what it doesn't.
We can't reset your password
There is no password on our side to reset. When you sign up you create a recovery passphrase or a passkey, and you can add recovery keys later in settings. Keep at least one safe. If you lose every device and every way back in, we can't open your account for you.
Sidekick asks first
Sidekick starts with no model and its tools switched off. You choose a model, and it asks before it uses your sheets or notes. It never moves your work to a different service without telling you.
If you pick a hosted model, what you send it can be read by that service while it answers. We'll always say when that is the case.
Payments go through Polar
We never see your full card number. Our payment provider, Polar, processes your payment. Polar shares your email address, name, billing address and country with us, plus the card type and its last four digits. We use them to run your subscription and send invoices. If you give Polar a tax number, it shares that too.
What you publish is public
When you publish a post, anyone with the link can read it, including our staff. Encryption protects your private workspace, not what you choose to publish.
Copies kept by search engines or web archives are outside our control.
Your work keeps working offline
Everything lives on your device first, so it opens without a connection. If our service is down, or a payment fails, you can still read and edit what's on your devices.
No ads, no data sales, no peeking
Your subscription pays for the service. We don't show ads, sell data or let anyone else look inside your account. Whoever pays for a Group plan doesn't get to look inside the other members' files either.
Want a cloud that can't read you?
Leave your email and we'll write when Pastel Cloud opens to its first members. Early places go to people who care about owning their work, and we'll let them in a few at a time.